Keycloak slow migration vs fast migration: moving your users
A slow migration moves users from a legacy system into Keycloak one at a time, as each of them logs in. It goes by other names too: lazy migration, just-in-time (JIT) migration, trickle migration. Nobody gets a password reset email, there is no cutover weekend, and users who never come back are never migrated.
The other side is a fast migration: a bulk import that moves every user into Keycloak at once, before or at cutover. It is quicker to finish and easier to reason about, but it needs something a slow migration doesn't, usually the users' password hashes.
Keycloak doesn't ship slow migration. You add it with a user storage provider, and the one almost everyone uses is open source on GitHub: daniel-frak/keycloak-user-migration. This post covers how slow and fast migrations work, where the code lives, how to choose, and how to combine the two so a slow migration doesn't drag on for months.
| Slow migration | Fast migration | |
|---|---|---|
| When users move | One at a time, at their next login | All at once, at import |
| Password hashes needed | No, the legacy system checks passwords | Yes, or users set a new password |
| Legacy system after cutover | Must stay up and answer the migration endpoints | Can be turned off |
| Dormant users | Never migrated unless you add a final step | Migrated with everyone else |
| Time to finish | Weeks to months, plus a long tail | Hours to days |